Use Case Builder Implementation Guide

The Use Case builder contains tools to help you measure and track use cases through your automation journey, quickly autogenerate OOTB playbooks and custom workflows and more.

Setup And Configuration

To run this content you will need to setup the Cortex REST API integration. To do this, simply download and install the content from the marketplace, generate a api key, then add your api key to the instance (Choosing the standard authentication method.) Once that is complete, you can start using the Use Case Builder!

Default Incident Type

This Pack includes an Incident Type of 'Use Case Builder', which is the starting point for creating new Use Cases. To use this, navigate to the +New Incidents -> Select Type -> Use Case Builder+ and fill out the form to begin.

Layouts

The Use Case type has an optimized layout for both the summary pages, and the new/edit screen. This layout includes some useful information and dropdowns to kickstart your automation journey

Playbook

The default playbook is Use Case Builder, this playbook is performs alot of complex task and time consuming actions for you. At it's core the playbook simply does the following:

Provide important information to get you started.
Clones and Autogenerates playbooks based off your selections
Set SLAs and Timers for the development stages
Renders Markdown and HTML
Generates the Use Case Defintion Document
Evaluates XSOAR Usage and sets Adoption Metrics

Timers

Optionally this playbook has built in Timers for adding metrics for time spent In Development, Testing, Backlog, Production,etc.

Dashboards

This pack includes 1 dashboards:

Use Case Development Dashboard: High level summary of all Use Cases in Development and their associated metric data.

Dynamic Sections

There are Several Dynamic sections in this pack such as the Getting Started, Common Use Cases and Incident Flow section which are your guide to following XSOAR Best Practices and creating great use cases

Name	Description
CreateUseCaseTemplateList
CreateUseCaseStepsList
UseCaseDevelopmentTimers
DeleteAndExcludeIndicators
UseCaseAdoptionMetrics
GettingStartedWithXSOAR
StopUseCaseDevelopmentTimer
UseCasePlaybookAutoGenerator
UseCaseBuilderMarkdownToHTML	Converts Markdown to HTML.
PlaybookAutoGeneratorDynamicSectionMessage
CreateXSOARIncidentFlowList

Name	Description
Use Case Development Dashboard
Use Case Automation

Name	Description
Use Case Builder Getting Started
Use Case SLAs
Use Case Builder IAM
Use Case Builder Forensics and Malware Analysis
Use Case Purpose
Trigger
Use Case TIM Best Practice
Use Case Development Timer
Use Case Builder Case Management
Use Case Production Timer
Use Case Testing Timer
Incident Structure and Mapping
Use Case Builder Network Security NGFW
UseCaseAdoptionMetrics
Use Case Builder Email Gateway
Network Security IDS
Use Case Builder Playbook Generator Key
Enrichment
Manual Steps
Custom Incident Data Structure
CVE Reference Links
Use Case Design Best Practice
Use Case Builder Authentication
Use Case Initiator	How is the incident created in XSOAR?
Use Case Builder SEIM
Customer Name
Use Case Development Stage
Use Case Builder Auto Generator Key
Use Case Builder Endpoint
Use Case Priority
Use Case Backlog Timer
Time to Remediate
Use Case Category	Select Use Case Category
Use Case Type	Select from pre-built templates or Out-of-the-Box Use Cases
Use Case Enrichment Steps
Incident Response Process
Use Case Enrichment Actions
Time to Investigate
Time to Triage
CVE Description
Use Case Builder Data Enrichment and Threat Intelligence
End-User Interactiveness
Third Party Integrations
Affected Host
subclassification	For CMNG
Deduplication Logic
Use Case Name
Use Case Pre-Production Timer
Use Case Builder Use Case Containment Steps
Use Case Builder Vulnerability Management
CVE Score
Use Case Ingestion Best Practice
Use Case Builder Development Deadline
XSOAR Incident Flow
Use Case Required Metrics and Notifications

Name	Description
Use Case Builder
Quick Start Use Case
XSOAR Training

Name	Description
Quick Start Remediation	This contains the remediation and triage steps for the Quick Start Investigation
Use Case Builder	The main playbook for the Use Case Builder
Generate Playbooks Based On Category	Takes the use case selected category and auto creates an example playbook
Create Use Case Template List	This Playbook creates the HTML Use Case Builder document list
Quick Start Main Playbook	The main playbook for the quick start incident
Setting up the Use Case Builder Content	This playbook generates the flow, markdown, and layout information
Create Use Case Steps List	This Playbook Creates the lists used in the Use Case Builder
Create XSOAR Incident Flow List	This playbooks creates the html process flow list
Entity Enrichment - Generic v4	Enrich entities using one or more integrations.
Generate Use Case Builder Lists	This playbook generates and saves the list types
Use Case Builder Playbook Reset	This playbook resets the incident when the user chooses to start over.
Quick Start Investigation	This playbook contains the investigation steps in the Quick Start Playbook

Name	Description
Total Use Cases
Use Cases in Development
Use Cases in Production
Use Case Backlog Time
Use Cases in Backlog
Use Cases On Track
Use Cases In Pre-Production
Use Case time in Production
Use Case Time Spent in Testing
Use Cases
Time Spent in Pre-Production
Use Case Development
Use Cases in Testing

Pack Name	Pack By
Active Directory Query	By: Cortex XSOAR
Base	By: Cortex XSOAR
CaseManagement-Generic	By: Cortex XSOAR Customer Success
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Atlassian Jira	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

Supported By	Community
Created	June 29, 2023
Last Release	December 18, 2024

Use Case Builder

Use Case Builder Implementation Guide

Setup And Configuration

Default Incident Type

Layouts

Playbook

Timers

Dashboards

Dynamic Sections

Incident Fields

Playbooks

Use Case Builder

Scripts

DeleteAndExcludeIndicators

CreateUseCaseStepsList

CreateXSOARIncidentFlowList

UseCaseDevelopmentTimers

StopUseCaseDevelopmentTimer

GettingStartedWithXSOAR

PlaybookAutoGeneratorDynamicSectionMessage

Scripts

UseCaseBuilderMarkdownToHTML

Scripts

UseCasePlaybookAutoGenerator

Scripts

UseCaseAdoptionMetrics

CreateUseCaseTemplateList

Scripts

UseCaseDevelopmentTimers

CreateUseCaseStepsList

GettingStartedWithXSOAR

CreateXSOARIncidentFlowList

StopUseCaseDevelopmentTimer

DeleteAndExcludeIndicators

PlaybookAutoGeneratorDynamicSectionMessage

Scripts

UseCaseBuilderMarkdownToHTML

Playbooks

Use Case Builder

Scripts

UseCasePlaybookAutoGenerator

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER